iLO 3: ssh timeout of 60 seconds ?

[heinrichborowski]

Hi All,

I noticed that other than iLO2, iLO3 appears to have a 60 seconds inactivity timeout when accessing it through ssh. Is that configurable anywhere ? One minute is very short, when you are trying to watch a server reboot.

Thanks in advance

Heinrich

[dpaulson]

In iLO3 - try setting "Idle Connection Timeout" to "Infinite" under web menu "Administration -> Access Settings".

Also it is often the client tool side that times out, not iLO. For example, PuTTY is a free SSH shell for Win/Linux and has a "re-negotiate ssh key" default timeout of 60 seconds. You can change that under "Connection->SSH->key->Max" to '0' for infinite

(thanks to PaulS for this tip).

[heinrichborowski]

===[ Issue ]===

the iLO3 ssh server appears not to reply to ssh ServerAlive requests.

$ ssh -V
OpenSSH_5.3p1 Debian-3ubuntu4, OpenSSL 0.9.8k 25 Mar 2009

$ cat .ssh/config
ServerAliveInterval 15
ServerAliveCountMax 3

$ ssh user@server-ilo
[after exactly 60 seconds]
hpiLO-> Timeout, server not responding.


===[ Explanation ]===

According to the configuration, a ServerAlive request is sent every 15 seconds. Three times the lack of a reply ist tolerated. When the forth request remains unanswered, the client drops the connection.


===[ Workaround ]===

$ ssh -o ServerAliveInterval=0 user@server-ilo

If you need ServerAlive messages in order to keep the connection open across an NAT Firewall, you could simply configure ssh to send a large number of ServerAlive messages without expecting a reply, e.g. the following command would time out after a day:

$ ssh -o ServerAliveInterval=15 -o ServerAliveCountMax=5759 user@server-ilo

===

@dpaulson

- Changing the "Idle Connection Timeout" on the web interface had no effect.
- I did not attempt to change any key re-negotiation timings as that would compromise the security of the conection.
- Thank you for mentioning a possible client side issue. This helped me find a workaround to this iLO3 bug.

Heinrich
(hwa)